Cost a remediation campaign: engineering hours with testing overhead, downtime, tooling, cost per finding and FTE months needed.
Two things make remediation cost estimates wrong in practice: forgetting the testing and change overhead, which is rarely below 25% for anything customer-facing, and costing engineer time at salary rather than at the opportunity cost of the roadmap work it displaces. The FTE-month output exists because budget approval usually hinges on whether the work fits the team you already have. Every remediation campaign competes for the same engineers as the product roadmap, and a cost per finding lets you argue for automation, golden images or decommissioning instead of brute force.
Remediation Cost
Engineering hours = findings × hours per fix × (1 + testing overhead). Total cost = hours × rate + downtime hours × downtime cost + tooling. Cost per finding = total ÷ findings.
Capacity conversion
FTE months = engineering hours ÷ 130, using 130 productive hours per person-month rather than 160 to allow for meetings, interruptions and leave.
Engineering hours = findings × hours per fix × (1 + testing overhead). Total cost = hours × rate + downtime hours × downtime cost + tooling. Cost per finding = total ÷ findings. Two things make remediation cost estimates wrong in practice: forgetting the testing and change overhead, which is rarely below 25% for anything customer-facing, and costing engineer time at salary rather than at the opportunity cost of the roadmap work it displaces. The FTE-month output exists because budget approval usually hinges on whether the work fits the team you already have.
Every remediation campaign competes for the same engineers as the product roadmap, and a cost per finding lets you argue for automation, golden images or decommissioning instead of brute force.
This calculator takes 7 inputs: Findings to remediate, Average engineering time per finding, Blended engineering cost, Testing and change overhead, Total planned downtime, Cost per hour of downtime, Tooling and licence cost for the campaign. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because a nominal 160-hour month loses time to meetings, incidents, interruptions and leave. Using 160 is the most common reason remediation plans slip by a third in their first month.
Batch it. Patching a golden image, bumping one shared dependency or decommissioning a host clears dozens of findings for the price of one change, which is why cost per finding falls fastest when you stop treating findings individually.